Single Sign-On for Code Management

Single Sign-On (SSO) is an authentication process that allows users to access multiple applications with a single set of login credentials. This simplifies the user experience by reducing the number of logins required and enhances security by centralizing authentication.

This guide will walk you through the steps to configure and use SSO for the Code Management application in both Qlik Enterprise (On-Premises) and Qlik SaaS environments.

Prerequisites

Before configuring SSO, ensure that the following prerequisites are met:

• A respective server should be created based on the environment (Qlik Enterprise or Qlik SaaS) in which you want to configure SSO. For instructions on how to create a server, refer to the Server Documentation.
• You must have administrative access to the Qlik SaaS account if you plan to configure SSO for Qlik SaaS.
• Browser Settings: Browser must accept third-party cookies.
• Proxy Setup: In the Proxy section, select the SSL certificate (with .pfx format) and provide the password (if available). Click Save. The page will reload, and the protocol will switch to https.

Note

For Qlik Enterprise, you must make url secure by converting from http to https.

SSO Configuration for Qlik Enterprise

Virtual Proxy Setup

Step 1. Log in to the Qlik Management Console (QMC): Go to CONFIGURE SYSTEM and click on Virtual Proxy.

Step 2. Virtual Proxy Setup: If a virtual proxy already exists and satisfies the configuration requirements described in this section, it can be used as-is. Otherwise, click Create new to set up a new virtual proxy.

Step 3. Configure the Virtual Proxy: Fill in the necessary details as shown below and click Apply to save the configuration.

Step 4. Link to Central: After applying the configuration, go to the Proxies section and click on (+) Link. Select Central and click Apply.

Step 5. Verify Virtual Proxy: Open the created virtual proxy in another window and log in.

Note

Prerequisites and Virtual Proxy Setup must be completed before proceeding.

Code Management Configuration

Step 1. Server Creation: Go to Settings and create a Server with the proper details. Add the hub URL created in the previous step. Test the connection and save the configuration.

Step 2. Configure Identity Provider: Navigate to Other Configurations, open Identity Provider, add the necessary details, and click Save.

Step 3. Authentication Setup: Go to the Authentication section, select the IDP you created, and click Save.

Step 4. Logout and Test SSO: Finally, navigate to the Admin section at the bottom left corner. Try logging out, and the page will reload and automatically log you back in, as the proxy service is running.

SSO Configuration for Qlik SaaS

You can also configure SSO for Code Management in Qlik SaaS. Follow the steps below:

Step-by-Step Configuration

Step 1. Log in to Qlik SaaS: Log in to Qlik SaaS with administrative privileges.

Step 2. OAuth setup: Go to Administration and navigate to OAuth. If an OAuth client already exists for this purpose, use that otherwise, click Create OAuth and fill in the details.

• for redirect url, go to the Code Management service http://localhost:4040/settings. Go to Identity Provider and Click Create new.

Step 3. Configure Identity Provider: Go to Other Configurations, open Identity Provider, add the necessary details, and click Save.

• Copy the redirect url and paste it under Redirect URL in the Qlik OAuth setup. This URL includes additional API path details trim it down to just the base URL and paste that under Allowed origins as well. Click Create.

Step 4. Server Setup: Use the server already created for the SaaS environment. If it hasn't been created yet, create one and configure it with the required details.

Step 5. Authentication Setup: Go to the Authentication section, select the IDP you created, and click Save.

Note

Don't forget to login in to Qlik SaaS before testing.

Step 6. Logout to Test SSO:
Navigate to the Admin section at the bottom left. Log out, and the page will reload, automatically logging you back in due to the proxy service.

---

Using the SSO Login Flow

Once the authentication route is configured and saved, end users access Code Management through the SSO-enabled login URL (e.g. https://localhost:4040/login) instead of the standard username/password screen.

Step 1. Navigating to the login URL redirects the user to the Qlik portal for authentication.

Step 2. If the browser blocks third-party cookies, the redirect fails and Code Management shows an Authentication Required screen: "Your session has expired or Qlik is not logged in. Please sign in to Qlik and try again.", along with a Third-party cookies blocked prompt from the browser.

Step 3. Click the cookie icon in the browser's address bar to open Cookies and site data, and switch Third-party cookies from Blocked to allowed.

Note

If the browser also flags the connection as Not secure, this is expected for locally issued/self-signed proxy certificates and does not by itself indicate an SSO misconfiguration.

Step 4. Click Retry (or Login) on the Authentication Required screen. With third-party cookies allowed and an active Qlik session, the page redirects and signs the user in automatically.

User Mapping

SSO authenticates a Code Management user based on their Qlik server credential, matched against a mapping field configured for that user. This credential must belong to the same Qlik server (Enterprise or SaaS) that was configured earlier as the Server and Identity Provider for this SSO route — a user mapped to a different Qlik server will not authenticate successfully. Each Code Management user must be mapped to their corresponding Qlik identity under Settings → Users, by opening the user and selecting Edit user:

• User directory (Local Enterprise server) — the on-prem directory account (e.g. Directory\Username), used when authenticating through a Qlik Enterprise SSO route.
• SaaS User Id or Email (SaaS - AP server) — the Qlik SaaS user's identity, used when authenticating through a Qlik SaaS SSO route.

If the Qlik credential used to authenticate is not mapped to an existing Code Management user, access is denied after the SSO redirect completes.

Note

To resolve this, the user must be mapped in Code Management under Settings → Users, matching their Qlik Enterprise directory account or Qlik SaaS user ID/email as appropriate.

This concludes the setup for SSO in both Qlik Enterprise and Qlik SaaS environments.